Skip to content

v1.4.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Jul 08:49
· 55 commits to main since this release
v1.4.2
7bd6a67

Mostly a packaging release: dist/ differs from 1.4.1 almost entirely in comment text. Full notes: CHANGELOG.md [1.4.2].

Fixed — the one real behaviour change

ADMIN_COOKIE now actually works. .env.example has documented that name since 1.1.3, but buildAdminCookies and buildRedactPatterns both read a differently-named variable. Anyone who followed the documentation got no admin cookie injected and, worse, no redaction of that value from reports and screenshots. Set ADMIN_COOKIE — which is what the documentation always said.

Removed

The published package no longer carries material that belonged to the project's private origins:

  • Internal project-tracking identifiers — task numbers, planning-register entries and iteration labels — across source comments, workflow headers, test headers, ADR metadata and six user-facing documents (77 places). tsconfig.json does not set removeComments, so source comments compile into dist/; the 1.4.1 tarball carried 24 of them.
  • A maintainer's name from a source comment, which shipped in 1.4.1 twice.
  • A third party's product identity — an environment variable name, config filenames and the scenario names describing that product's feature surface. It appeared in ten files, four of them in src/, and six times in the 1.4.1 tarball.
  • A separate private repository's name, and a link to a gitignored internal planning document.

Verified against the tarball downloaded from the registry, not assumed:

1.4.1 1.4.2
Maintainer name 2 0
Third-party product 6 0
Tracking identifiers 24 0
Non-English in CHANGELOG / README 0 0

Added

  • scripts/check-no-internal-refs.ts, run as part of npm test. ADR numbers, CVE identifiers, version numbers and the word "worktree" are deliberately not matched — those are real technical references. It caught two of the leaks above during this very cleanup.

Note on git history

The repository's git history was reset to a single baseline commit. It grew out of a private working notebook whose history carried the material listed above, and removing a path from history is not the same as never having published it. Every released version remains on npm with its provenance attestation, and the GitHub releases keep their notes and SBOM artefacts.

Published to npm with SLSA provenance. CycloneDX SBOM attached below.

Assets 3
Loading